Deobfuscate/Decode Files or Information

An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.^[66]

An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.^[67][68]

Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code.^[40]

AuditCred uses XOR and RC4 to perform decryption on the code functions.^[25]

Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.^[28][29]

Bankshot decodes embedded XOR strings.^[15]

BBSRAT uses Expand to decompress a CAB file into executable content.^[39]

Bisonal decodes strings in the malware using XOR and RC4.^[5]

BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload. ^[53]

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.^[57]

Carbon decrypts task and configuration files for execution.^[26]

Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.^[37]

certutil has been used to decode binaries hidden inside certificate files as Base64 information.^[1]

CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.^[43]

Darkhotel has decrypted strings and imports using RC4 during execution.^[65]

DDKONG decodes an embedded configuration using XOR.^[16]

Denis will decrypt important strings used for C&C communication.^[38]

Dyre decrypts resources needed for targeting the victim.^[20]

Expand can be used to decompress a local or remote CAB file into an executable.^[4]

Final1stspy uses Python code to deobfuscate base64-encoded strings.^[9]

FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.^[18][19]

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.^[63]

HiddenWasp uses a cipher to implement a decoding function.^[48]

Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.^[58]

InvisiMole can decrypt, unpack and load a DLL from its resources.^[13]

ISMInjector uses the certutil command to decode a payload file.^[21]

Kwampirs decrypts and extracts a copy of its main DLL payload when executing.^[22]

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.^[55]

LightNeuron has used AES and XOR to decrypt configuration files and commands.^[49]

Machete’s downloaded data is decrypted using AES.^[51]

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.^[61][62]

MirageFox has a function for decrypting data containing C2 configuration information.^[10]

More_eggs will decode malware components that are then dropped to the system.^[52]

MuddyWater decoded base64-encoded PowerShell commands using a VBS file.^[59][60][6]

NOKKI uses a unique, custom de-obfuscation technique.^[7]

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.^[54][21][30]

OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.^[30]

OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads.^[50]

PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.^[8]

POWERSTATS can deobfuscate the main backdoor code.^[6]

Proton uses an encrypted file to store commands and configuration values.^[36]

PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.^[45]

QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.^[11]

Remexi decrypts the configuration data using XOR with 25-character keys.^[41]

RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.^[14]

RogueRobin decodes an embedded executable using base64 and decompresses it.^[42]

Smoke Loader deobfuscates its code.^[12]

SQLRat has scripts that are responsible for deobfuscating additional scripts.^[47]

Starloader decrypts and executes shellcode from a file called Stars.jps.^[17]

During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.^[64]

TrickBot decodes the configuration data and modules.^[24]

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload.^[56]

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.^[70]

One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".^[35]

Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.^[44]

VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.^[23]

Volgmer deobfuscates its strings and APIs once its executed.^[32]

WIRTE has decoded a base64 encoded document which was embedded in a VBS script.^[69]

Yahoyah decrypts downloaded files before execution.^[46]

Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.^[33][34]

ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.^[31]

Zeus Panda decrypts strings in the code during the execution process.^[27]